The digital trail you pay for without knowing it: cookies, retargeting and VPNs

The digital trail you pay for without knowing it: cookies, retargeting and VPNs

Every time you search for a flight and then see it advertised for weeks on every website you visit, it is no coincidence. It is retargeting, the technique Google branded as Re-Marketing and Criteo popularized as Re-targeting: thanks to cookies and the trail you leave while browsing, advertisers trinc you wherever you go to remind you of what you were looking at. Online privacy stopped being a topic for geeks years ago and became an everyday consumer issue, with documentaries, data portability projects and even smart TVs that listen more than they say.

What retargeting is and why it trinc you around

The mechanism is simple and ruthless. You enter a website, accept — or don't even do that — the cookies, and from then on your browser carries an invisible tag. That tag allows Facebook to know which pages you visit outside Facebook, as blogger Enrique Dans explained, and lets the advertiser of the day show you the same product for days on end. It is not magic, it is tracking.

The most common response among those who take it seriously is radical: no Google, no Gmail, no Maps, no search engine. A Firefox add-on called Do Not Track Me boasts of having blocked hundreds of thousands of tracking attempts in a single year. Others go further and recommend setting up your own outgoing mail server, replacing Chrome with Iron — the same browser but clean — and deleting cookies regularly.

The problem, as more skeptical voices point out, is that there is little point in fortifying your end if the recipient of the email doesn't care. And that is where, in 99% of cases, the whole thing falls apart.

VPNs, proxies and the myth of total anonymity

The conversation soon turned to more robust solutions. VPNs headquartered in tax havens — the British Virgin Islands, Panama, Switzerland — are presented as the definitive tool: they keep no logs, do not cooperate with foreign agencies and encrypt the connection. ExpressVPN, NordVPN and Perfect Privacy top the usual lists. The problem is that trusting that they keep no logs is, at bottom, an act of faith.

Some point out that without an encrypted tunnel and without proxies, securing the browser is of little use. And others note that constant software updates are not just improvements: they are also patches for holes someone is already exploiting.

Fingerprinting: when deleting cookies is not enough

Here comes the uncomfortable fact. Even if you delete cookies, fingerprinting can still identify you: browser characteristics, operating system, screen resolution, installed fonts. If your combination is rare enough, you are unique. There are tests that check this and return results like 1 in 800,000, according to a calculation circulating in the thread. In other words, your configuration can be more incriminating than your name.

The technical answer involves the user agent switcher, which lets you disguise the browser and operating system the server thinks it sees. Changing your MAC address also helps, and some Linux distributions do it by default.

Encrypted messaging: Signal and faith in the code

The arrival of Signal on Android, backed by Edward Snowden, reignited the debate about secure messaging. For some it is the real alternative to WhatsApp; for others, just another scam: according to these voices, it uses proprietary Google code and its encryption only serves to keep out the nosy neighbor, not a state agency. The conclusion that keeps coming up: if you use Tor, obscure apps and privacy gadgets, the only thing you achieve is drawing attention to yourself.

TVs, set-top boxes and the leap into the living room

Privacy is no longer confined to the computer. Cable and fiber TV set-top boxes constantly send information: what you request from the server, when you skip forward, what channel you watch. Every device is a potential audience meter. And smart TVs add another layer of domestic surveillance that few people read about in the purchase contract.

Real alternatives and the limits of skepticism

Alternatives do exist: search engines that do not track you, email providers that do not scan messages, text-only browsers like W3M, mobile operating systems that are alternatives to Android. CyanogenMod abandoned the project, but LineageOS picked up the baton. The question hanging over everything is always the same: what is the point of all this effort if the system is designed so you cannot escape?

The most honest answer going around is that absolute privacy does not exist, but the trail can be reduced. And that the first step is knowing exactly what you are giving away every time you accept a cookie.

With these tools on the table, the reasonable expectation is that regulatory pressure will increase and that manufacturers will keep selling privacy as a premium antiestéticature. What does not seem likely is that the trail will disappear. It will simply change shape.